CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition (page 2)
Page 2 of 9 — CVEs classified under CWE-367, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-49415 | High | 8.8 | 2026-08-19 | During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process runnin… |
CVE-2026-76044 | High | 8.3 | 2026-08-18 | Race condition in USB in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to potentially execute arbitr… |
CVE-2026-70667 | Medium | 6.3 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the l… |
CVE-2026-71539 | | 2026-08-18 | n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user t… | |
CVE-2026-73410 | High | 8.5 | 2026-08-17 | Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent… |
CVE-2026-19975 | Low | 3.1 | 2026-08-17 | A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.ph… |
CVE-2026-16967 | High | 8.5 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to system objects due to a time-of-check to time-of-use (T… |
CVE-2026-16896 | High | 7.1 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to obtain unauthorized access to files due to a time-of-check time-of-use (TOCTOU) race… |
CVE-2026-53801 | Medium | 5.9 | 2026-08-13 | rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumer… |
CVE-2026-53800 | Medium | 4.7 | 2026-08-13 | rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to c… |
CVE-2026-53799 | Medium | 6.3 | 2026-08-13 | rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to… |
CVE-2026-53797 | Medium | 4.7 | 2026-08-13 | rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent di… |
CVE-2026-53796 | Medium | 6.3 | 2026-08-13 | rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling th… |
CVE-2026-63297 | Critical | 9.9 | 2026-08-12 | An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restri… |
CVE-2026-49262 | Low | 3.0 | 2026-08-12 | In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request For… |
CVE-2026-12234 | High | 7.8 | 2026-08-12 | The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct net_m… |
CVE-2026-62728 | High | 7.0 | 2026-08-11 | Time-of-check time-of-use (toctou) race condition in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2026-20908 | Medium | 5.3 | 2026-08-11 | Time-of-check time-of-use race condition for the Intel(R) NPU Driver for Windows for all versions within Ring 1: Device Drivers may allow a denial of service… |
CVE-2026-6505 | Medium | 5.1 | 2026-08-11 | The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability ca… |
CVE-2026-5303 | Medium | 5.7 | 2026-08-11 | The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability ca… |
CVE-2026-72584 | High | 7.4 | 2026-08-10 | A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on… |
CVE-2026-19079 | Medium | 4.4 | 2026-08-07 | A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfile… |
CVE-2026-43632 | High | 8.1 | 2026-08-06 | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detok… |
CVE-2026-57818 | High | 8.1 | 2026-08-06 | A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the is… |
CVE-2026-55524 | High | 7.5 | 2026-08-05 | PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF check only on the initially supplied URL, allowing t… |
CVE-2026-70597 | Medium | 6.3 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the… |
CVE-2026-71272 | High | 8.5 | 2026-08-05 | Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates th… |
CVE-2026-71210 | Medium | 5.3 | 2026-08-05 | Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules… |
CVE-2026-54020 | Medium | 6.3 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and… |
CVE-2026-47621 | Medium | 6.5 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful expl… |
CVE-2026-58041 | Medium | 5.3 | 2026-08-04 | A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statem… |
CVE-2026-66314 | Medium | 6.5 | 2026-08-04 | Time-of-check time-of-use (toctou) race condition in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-11835 | | 2026-08-04 | Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows… | |
CVE-2026-47746 | | 2026-08-03 | Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, are vulnerable to timing attacks during JSON-LD… | |
CVE-2026-18477 | Medium | 4.4 | 2026-08-03 | A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a director… |
CVE-2026-20492 | Medium | 5.5 | 2026-08-03 | In Audio HAL, there is a possible system becoming unresponsive due to a race condition. This could lead to local denial of service with User execution privileg… |
CVE-2026-20474 | Medium | 6.0 | 2026-08-03 | In display, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of privilege if a malicious actor has alre… |
CVE-2026-67607 | Medium | 5.9 | 2026-07-31 | LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete fix for CVE-2024-11144) in the worker_thread_cleanup() function of ftpserv.c tha… |
CVE-2026-67433 | | 2026-07-29 | Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legac… | |
CVE-2026-13113 | Medium | 6.5 | 2026-07-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain condi… |
CVE-2026-56822 | High | 7.4 | 2026-07-29 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forw… |
CVE-2026-55391 | High | 7.5 | 2026-07-28 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw J… |
CVE-2026-62428 | High | 7.8 | 2026-07-28 | When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy… |
CVE-2026-64284 | High | 7.1 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the hand… |
CVE-2026-59676 | | 2026-07-23 | A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in th… | |
CVE-2026-65598 | High | 7.5 | 2026-07-22 | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restr… |
CVE-2026-64112 | High | 7.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: rbd: eliminate a race in lock_dwork draining on unmap Given how rbd_lock_add_request() an… |
CVE-2026-64091 | Critical | 9.8 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated b… |
CVE-2026-16082 | Medium | 5.3 | 2026-07-18 | A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipeline_execute… |
CVE-2026-54242 | Medium | 4.9 | 2026-07-17 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/Remot… |
CVE-2026-62212 | High | 7.1 | 2026-07-17 | OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-… |
CVE-2026-53410 | High | 7.0 | 2026-07-16 | A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authen… |
CVE-2026-15449 | | 2026-07-16 | A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctl… | |
CVE-2026-53518 | High | 8.1 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint… |
CVE-2026-53517 | High | 8.1 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token e… |
CVE-2026-45804 | High | 7.5 | 2026-07-15 | Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code… |
CVE-2026-48344 | High | 7.8 | 2026-07-14 | Creative Cloud Desktop is affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the co… |
CVE-2026-57973 | Medium | 6.3 | 2026-07-14 | Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally. |
CVE-2026-56648 | High | 7.5 | 2026-07-14 | Time-of-check time-of-use (toctou) race condition in Windows Network File System allows an authorized attacker to elevate privileges over a network. |
CVE-2026-56178 | Medium | 5.5 | 2026-07-14 | Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. |
CVE-2026-50673 | High | 7.8 | 2026-07-14 | Null pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-50658 | High | 7.0 | 2026-07-14 | Time-of-check time-of-use (toctou) race condition in Microsoft Defender allows an authorized attacker to elevate privileges locally. |
CVE-2026-4018 | Medium | 6.4 | 2026-07-14 | TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE abili… |
CVE-2026-62189 | High | 7.1 | 2026-07-13 | OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requi… |
CVE-2026-45203 | High | 7.8 | 2026-07-10 | Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of… |
CVE-2026-56676 | High | 7.4 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/ima… |
CVE-2026-58198 | Medium | 5.5 | 2026-07-09 | ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract() uses a predictable home-r… |
CVE-2025-58151 | | 2026-07-09 | varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffe… | |
CVE-2026-54777 | Medium | 6.5 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF NetNamedPipe transport accepts… |
CVE-2026-43927 | | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, a race condition in the cart checkout flow allows an authentic… | |
CVE-2026-25271 | High | 7.8 | 2026-07-06 | Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between check and use. |
CVE-2026-58299 | High | 7.5 | 2026-07-03 | Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execute code over a network. |
CVE-2026-55950 | Medium | 5.9 | 2026-07-02 | Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl (dtls_packet_demux module) allows an unauthenticated remote attacker to crash… |
CVE-2026-24260 | High | 8.5 | 2026-07-01 | NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time-of-use race condition. A successful exploit of t… |
CVE-2026-12374 | | 2026-07-01 | Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the PrivilegedHelperTool XPC service in Cato Client before v.5.13.1… | |
CVE-2026-14160 | Medium | 5.9 | 2026-06-30 | Time-of-check time-of-use (TOCTOU) race condition vulnerability in Samsung Open Source Escargot allows Leveraging Race Conditions. This issue affects Escargot… |
CVE-2026-57959 | Medium | 5.9 | 2026-06-29 | Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before asynchronous UpdateEventStatisticsJob inc… |
CVE-2026-13742 | | 2026-06-29 | Honeywell IQ MultiAccess, all versions prior to and including version 28, contain an improper digital signature verification vulnerability. An attacker could p… | |
CVE-2026-54370 | Medium | 6.3 | 2026-06-29 | acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by re… |
CVE-2026-13502 | Medium | 4.5 | 2026-06-28 | A flaw has been found in antlr ANTLR4 up to 4.13.2. This affects the function ObjectInputStream.readObject of the file antlr4-maven-plugin/src/main/java/org/an… |
CVE-2026-54353 | High | 8.5 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation permissions can bypass Budibase's SSRF blacklist through DNS… |
CVE-2026-52885 | Medium | 6.3 | 2026-06-26 | Notepad++ is a free and open-source source code editor. Prior to 8.9.6.4, NppCommands.cpp checks the HMAC of the on-disk shortcuts.xml at the moment a user com… |
CVE-2026-53250 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() The TX metadata are… |
CVE-2026-53145 | High | 7.8 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: drm/gem: Try to fix change_handle ioctl, attempt 4 [airlied: just added some comments on… |
CVE-2026-53945 | Medium | 4.0 | 2026-06-24 | Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding… |
CVE-2026-52991 | High | 7.8 | 2026-06-24 | In the Linux kernel, the following vulnerability has been resolved: sched/psi: fix race between file release and pressure write A potential race condition ex… |
CVE-2026-54327 | Low | 2.2 | 2026-06-23 | Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi stored API keys and OAuth credentials in auth.json. A race condition in the file write pa… |
CVE-2026-48931 | Low | 3.7 | 2026-06-22 | A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affect… |
CVE-2026-41045 | High | 8.1 | 2026-06-22 | A time-to-check-time-of-use in polkit authentication of qSnapper before version 1.3.3 allowed a local attacker to bypass qSnappers authentication mechanism and… |
CVE-2026-48983 | Medium | 5.8 | 2026-06-18 | pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, a symlink race condition exists in per-device an… |
CVE-2026-6733 | Low | 3.7 | 2026-06-17 | Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an u… |
CVE-2026-54228 | High | 7.8 | 2026-06-13 | A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-crea… |
CVE-2026-53838 | Critical | 9.8 | 2026-06-12 | OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes to confuse approval scope decisions. At… |
CVE-2026-53831 | High | 8.3 | 2026-06-12 | OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command… |
CVE-2026-53822 | High | 8.8 | 2026-06-12 | OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between approval and execution. Attackers can rebuil… |
CVE-2026-54055 | Medium | 5.0 | 2026-06-12 | Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.2, a local privilege escalation vulnerability exists in kitty's file transmission proto… |
CVE-2026-42306 | High | 7.2 | 2026-06-12 | Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version… |
CVE-2026-41568 | Medium | 6.1 | 2026-06-12 | Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version… |
CVE-2026-50631 | High | 7.4 | 2026-06-12 | A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple vali… |
CVE-2026-53806 | High | 8.8 | 2026-06-11 | OpenClaw before 2026.5.12 contains a shell option parsing vulnerability that allows combined POSIX shell flags to bypass exec revalidation checks. Attackers ca… |